Does Splunk use TLS/SSL in communication between components?

[Haleb]

Could you please confirm whether Splunk utilizes TLS/SSL for the following communications by default or it should be manually configured:

1. Between Search Heads and Indexers
2. Between Indexers (Index Clustering)

[deepakc · Accepted solution]

By Default when you install Splunk it installs default certs that can be used, but these should be changed as per your organisations TLS cert process alongside the TLS requirements as per the Splunk docs. The default ones are only used for testing, POC etc. 

If you look at the table from this document link, it shows the various components and TLS cert scenarios for Splunk enterprise and cloud and default status.

https://docs.splunk.com/Documentation/Splunk/9.2.1/Security/AboutsecuringyourSplunkconfigurationwith... 

So, in your case.

1. (Between Search Heads and Indexers) You would need to create TLS cert for Web Browser Access, not use the default ones, unless just testing - this will give you config and search data. Note the SH should be connected to the Indexers via the Cluster Manager.
2. Between Indexers (Index Clustering) - If you configure indexers in a cluster, they should also use TLS certificate - this will be for replication data, again its best to create your TLS certs for all the indexers.

Side note: You typically also use the UF's with the indexers certs for UF to Indexer TLS data encryption.

Here's a good link for Splunk TLS certs process and understanding

https://lantern.splunk.com/Splunk_Platform/Product_Tips/Administration/Securing_the_Splunk_platform_...